Description
A server controlled by an attacker can send an invalid XML that can
trigger an out-of-bound memory access. This might lead to a crash or, in
some extreme cases, to remote code execution in the client-side
(CVE-2017-2640).
The pidgin package has been updated to version 2.12.0, which fixes this
issue and other bugs, including certificate validation for the Google Talk
protocol. It also removes protocol plugins for services that are no longer
available or supported. See the upstream ChangeLog for details.